Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LibreSSL

libressl.org

Post reply on HN
Print view View original

241–250 of 262 posts

Re: LibreSSL

#241

Post by boklm »

gnoway wrote: post #199
gnoway wrote: post #161

Earlier quoted context omitted.

Git uses SHA-1 hashes, which have not been considered cryptographically secure since 2005. Git and CVS are both just tools. They each provide a server implementation, but it's uncommon to use either of these for write access in large projects. It's more common to wrap CVS or Git with a different frontend like HTTPS or SSH. My guess is that the OpenBSD guys use OpenSSH. This team is fanatical about security and proces…

The edit button is gone. I guess these expire? My reply was not intended as an attack on Git. I use it daily and would choose it 10 times out of 10 vs. CVS for a new project. I just think the assertion that Git 'saved' Linux from some backdooring attempts because it's decentralized and uses cryptographic hashes is wrong; it's not the tools that make this happen, it's the processes around the use of these tools which…

> Basically, I don't see any reason to question their use of CVS.

Why not ?

With CVS, the security rely on the security of a single server. Anybody with root access to the CVS server can modify history, and nobody would notice.

Re: LibreSSL

#242

Post by antocv »

nfoz wrote: post #226
antocv wrote: post #138

Earlier quoted context omitted.

For security reasons. It is possible with CVS and even SVN to insert bad code on their repository server - but with git thats a much harder if not impossible to do.

Can you explain how this attack works, or provide a link?

Lets assume somehow you as attacker got access to the box where their CVS process is running.

Now you can edit a file, insert a line or change a "uid != 0" to "uid = 0", you also edit the history of the CVS repistory to make it seem that this change was introduced with some patch 3 years ago by Theo. Because its CVS or SVN the history is in the server, and not on every developers computers. Next time the devs build the tar.gz for distribution your bug is in it.

This wont be allowed with Git or Mercurial, because if you try to rewrite the history, well good luck making a SHA-1 collision on source files. That stops it.

Re: LibreSSL

#243

Post by copergi »

papaf wrote: post #239
copergi wrote: post #235

Earlier quoted context omitted.

11/11/2009 is not 8 years ago. That "better link" is exactly what I was referring to.

From the OpenNTPD homepage at http://www.openntpd.org/ Portable OpenNTPD 3.9p1 released May 14, 2006. It would be good if you could explain what I am missing. If there are more recent Linux releases and the information on the Redhat bug tracker is incorrect I would like to know. I'd rather be running OpenNTPD than ntpd.

ftp://ftp.openbsd.org/pub/OpenBSD/OpenNTPD/

Re: LibreSSL

#244

Post by caseydurfee »

alexcroox wrote: post #54
sarahj wrote: post #19

I understand the point but this comes across as immature. OpenSSL has provided years of free software, supporting thousands of sites and applications. Of course it has its problems, and there is nothing wrong with adding more competition in this space. But what this space needs now, more than ever, is professionalism and pride in craft (by which I mean demonstrable unit test coverage, regression testing, fuzz testing…

Agreed, the tone of the page and the footer prevents me from taking these guys seriously, especially in this area (even more so with recent events).

I refuse to run any software that's not hipstergraphically secure.

Re: LibreSSL

#246

Post by woodson »

copergi wrote: post #243
papaf wrote: post #239

Earlier quoted context omitted.

From the OpenNTPD homepage at http://www.openntpd.org/ Portable OpenNTPD 3.9p1 released May 14, 2006. It would be good if you could explain what I am missing. If there are more recent Linux releases and the information on the Redhat bug tracker is incorrect I would like to know. I'd rather be running OpenNTPD than ntpd.

ftp://ftp.openbsd.org/pub/OpenBSD/OpenNTPD/

To be fair, all releases after the one cited by papaf don't have a corresponding portable release (and that's what this thread is about).

Re: LibreSSL

#247

Post by hackuser »

icebraining wrote: post #98
tragic wrote: post #79

Earlier quoted context omitted.

Ask yourself which hipster start-up is going to do a comprehensive rewrite job on OpenSSL - or, for that matter, which SV VC is going to bung a few million green sheets into something like this (which, if we're honest, we could all do with happening, rather than the next DOA social media start up with a -ly/-able/-r suffix). If these people are prepared to take this on, then they can use whatever fonts they bloody we…

Firefox dumped it in version 23, and they did report that on the changelog[1]. jwz even wrote a post lamenting it[2]. [1] https://www.mozilla.org/en-US/firefox/23.0/releasenotes/ [2] http://www.jwz.org/blog/2013/08/a-light-has-gone-out-on-the-...

But it blinks in FF 24 ESR ...

Re: LibreSSL

#248

Post by mehrdada »

gioele wrote: post #195
claudius wrote: post #62

Earlier quoted context omitted.

They are already placing completely rewritten files under ‘better’ licenses, so the license switch might happen file-by-file over a long period of time.

Is that strategy possible at all? Are there cases tested in courts (both US and EU) that assert that the file-by-file licence replacement really works?

Why wouldn't it? The author of the file will be the copyright holder by the virtue of authoring it. If she does not get rid of it, she still remains the copyright holder. Copyright does not switch owners purely by the virtue of distribution with another piece of work.

IANAL.

Re: LibreSSL

#249

Post by gioele »

mehrdada wrote: post #248
gioele wrote: post #195

Earlier quoted context omitted.

Is that strategy possible at all? Are there cases tested in courts (both US and EU) that assert that the file-by-file licence replacement really works?

Why wouldn't it? The author of the file will be the copyright holder by the virtue of authoring it. If she does not get rid of it, she still remains the copyright holder. Copyright does not switch owners purely by the virtue of distribution with another piece of work. IANAL.

But isn't the ISC file a "derivate work" of the Apache 1.0 and thus subject to the same limits?

Re: LibreSSL

#250

Post by euske »

This is one of the best things that happened in the open source world recently. I like their attitude towards "web hipsters" too. They're serious folks who shut up and write AND READ codes.

It's funny that they do this "donate to stop blinking" thing again. They have been doing it for OpenSSH since 2000. cf. http://www.openssh.com/

Post reply on HN